3 ms·

Yes, that would work. It still sucks that if I want a browser on my LAN to talk with a server on the same LAN, I now somehow still need internet access (to ren

by xg15 3y ago

Yes, that would work. It still sucks that if I want a browser on my LAN to talk with a server on the same LAN, I now somehow still need internet access (to renew the cert), need at least two accounts on 3rd part cloud services (the domain registrar and Let's Encrypt) and have to continuously pay for the domain. Oh, and also have to mess around with the DNS configuration on the router, so the domain is correctly resolved to your LAN IP inside the network, but does not have A/AAAA records on the internet. Also, this solves this problem for geeks with some knowledge of network protocols, but it still leaves everyone stranded who would like to run a local server but has no deep technical knowledge. Finally, it's impossible to solve this problem in a large-scale manner, i.e. for devices you want to sell. Which is why the access menus for home routers will probably still stay on plaintext HTTP.

insanitybit 3y ago
I don't think you need to pay for a domain, nor do you need internet access to renew the certificate. You could either just have the cert point to an IP, or you could have the domain resolve to something at the router level/ configure our DNS however you like so that it resolves to the other device. Or you can just disable the strict HTTPS settings, which this post addresses? > We know that enterprises and education networks have unique needs. These features can be turned on early, customized, or turned off entirely via the HttpsOnlyMode, HttpsUpgradesEnabled, HttpAllowlist, and InsecureContentAllowedForUrls policies.
- xg15 3y ago
  > I don't think you need to pay for a domain, nor do you need internet access to renew the certificate. You could either just have the cert point to an IP, or you could have the domain resolve to something at the router level/ configure our DNS however you like so that it resolves to the other device. If I use a custom root CA, I don't need a domain. However, then my local server will only be accessible on devices where I can install the custom CA, i.e. usually, my own devices only. If I want the server accessible to other people, I need a cert from a real CA - and those are basically forbidden from granting certs for 192.168.* IPs or really anything that is not a properly registered internet domain: https://www.globalsign.com/en/blog/certificates-for-internal-servers https://www.globalsign.com/en/blog/certificates-for-internal... > Or you can just disable the strict HTTPS settings, which this post addresses? That as well works for my own device, but not for devices of other people.
  - insanitybit 3y ago
    So the situation is that someone is in your home with their own device and you don't want them to click through the "HTTP" warning? Seems niche tbh but I can understand that I guess.
    - xg15 3y ago
      The HTTP warning may become progressively harder and more confusing to click through, if chrome continues its strategy as they announced in the OP. Usecases would be more something like "shared server in a student dorm / local server for family and friends / art installation where people are supposed to connect their phones to / smart device with a local web server for configuration", etc. Niche indeed compared to the public internet, but still substantial.
      - janosdebugs 3y ago
        How substantial are the situations really where you can't afford a 10-15$ domain and running a trivially simple tool to obtain a certificate? What kind of an art installation has the budget to set up a wifi network, set up servers, etc but then doesn't have internet? (Most phones won't even connect to a wifi network without internet if I remember correctly.)
janosdebugs 3y ago
Funnily enough, some companies managed to solve the router problem. The Unifi Dream Machine is perfectly first-time configurable from a mobile app. Simpler routers don't really need any configuration these days and most people get routers from their provider anyway, whether they like it or not. When talking about smart home devices, much of these are configured via their own apps, it's not like you are accessing a web interface much. If you are... well, there have been a number of remote code executions in these, so I'm not sure that bypassing a certificate warning is the biggest problem here. Generally, I believe if someone can't set up a certificate then they don't have any business running web services for other people. The big problem is that it's not trivial for a browser to decide what's on "the local network" and what isn't.
- xg15 3y ago
  Yeah, I think the general trend is that all those devices either assume you have an app or only talk to the vendor's cloud service anyway. It's working, it just ensures that absolutely everything needs internet access.
  - janosdebugs 3y ago
    We had a few decades to come up with a viable trust model for the local network. We didn't and it's not like we can install software without internet access anymore, so maybe it's time to move on.

by xg15 3y ago

insanitybit 3y ago

I don't think you need to pay for a domain, nor do you need internet access to renew the certificate. You could either just have the cert point to an IP, or you could have the domain resolve to something at the router level/ configure our DNS however you like so that it resolves to the other device. Or you can just disable the strict HTTPS settings, which this post addresses? > We know that enterprises and education networks have unique needs. These features can be turned on early, customized, or turned off entirely via the HttpsOnlyMode, HttpsUpgradesEnabled, HttpAllowlist, and InsecureContentAllowedForUrls policies.

xg15 3y ago
> I don't think you need to pay for a domain, nor do you need internet access to renew the certificate. You could either just have the cert point to an IP, or you could have the domain resolve to something at the router level/ configure our DNS however you like so that it resolves to the other device. If I use a custom root CA, I don't need a domain. However, then my local server will only be accessible on devices where I can install the custom CA, i.e. usually, my own devices only. If I want the server accessible to other people, I need a cert from a real CA - and those are basically forbidden from granting certs for 192.168.* IPs or really anything that is not a properly registered internet domain: https://www.globalsign.com/en/blog/certificates-for-internal-servers https://www.globalsign.com/en/blog/certificates-for-internal... > Or you can just disable the strict HTTPS settings, which this post addresses? That as well works for my own device, but not for devices of other people.
- insanitybit 3y ago
  So the situation is that someone is in your home with their own device and you don't want them to click through the "HTTP" warning? Seems niche tbh but I can understand that I guess.
  - xg15 3y ago
    The HTTP warning may become progressively harder and more confusing to click through, if chrome continues its strategy as they announced in the OP. Usecases would be more something like "shared server in a student dorm / local server for family and friends / art installation where people are supposed to connect their phones to / smart device with a local web server for configuration", etc. Niche indeed compared to the public internet, but still substantial.
    - janosdebugs 3y ago
      How substantial are the situations really where you can't afford a 10-15$ domain and running a trivially simple tool to obtain a certificate? What kind of an art installation has the budget to set up a wifi network, set up servers, etc but then doesn't have internet? (Most phones won't even connect to a wifi network without internet if I remember correctly.)

janosdebugs 3y ago

Funnily enough, some companies managed to solve the router problem. The Unifi Dream Machine is perfectly first-time configurable from a mobile app. Simpler routers don't really need any configuration these days and most people get routers from their provider anyway, whether they like it or not. When talking about smart home devices, much of these are configured via their own apps, it's not like you are accessing a web interface much. If you are... well, there have been a number of remote code executions in these, so I'm not sure that bypassing a certificate warning is the biggest problem here. Generally, I believe if someone can't set up a certificate then they don't have any business running web services for other people. The big problem is that it's not trivial for a browser to decide what's on "the local network" and what isn't.

xg15 3y ago
Yeah, I think the general trend is that all those devices either assume you have an app or only talk to the vendor's cloud service anyway. It's working, it just ensures that absolutely everything needs internet access.
- janosdebugs 3y ago
  We had a few decades to come up with a viable trust model for the local network. We didn't and it's not like we can install software without internet access anymore, so maybe it's time to move on.